CodeVetter · Repo Unpack · Risk map
reduxjs/redux-toolkit
These findings describe source-visible trust boundaries and maintenance hazards, not confirmed vulnerabilities. Network destinations, executable configuration, and generated-file writes deserve explicit ownership in consuming applications. Cache behavior also depends on middleware installation, request completion, and rehydration timing. Test limitations and package-resolution coupling constrain what source inspection alone can establish.
- fetchBaseQuery prepares headers before joining URLs, and joinUrls accepts absolute endpoint URLs unchanged. Applications that attach bearer headers indiscriminately must review endpoint destination control; this is a source-visible trust boundary, not a demonstrated leak.
- The authentication fixture stores user/token in Redux and its mock login returns a token without checking submitted credentials; PrivateOutlet checks user presence. It demonstrates request authentication wiring rather than production credential validation.
- OpenAPI CLI configuration is executable input: optional TypeScript loaders are registered, cwd changes to the config directory, and require(configFile) executes it. Schema bundling accepts HTTP resolution and outputFile is resolved without a repository-root restriction.
- The codemod CLI derives the transform path from argv[2], expands user-supplied globs, and invokes jscodeshift through execaSync with inherited stdio; the inspected invocation supplies no dry-run option.
- API middleware installation is a functional requirement: React hooks probe it and throw a development error when missing, while handler execution requires state at reducerPath and registration tracks API identity conflicts.
- Delayed invalidation is the default and waits while the middleware's pending-request counter is positive. Schema failures without catchSchemaFailure bypass normal tag handling, making request completion and error classification consequential cache-consistency boundaries.
- Persistence documentation warns about stale API data; cache collection explicitly notes that rehydration before endpoint injection uses global retention instead of endpoint-specific keepUnusedDataFor.
- Artifact validation is sensitive to aliases and workspace linking: CI removes source aliases, changes the package name, and detaches portability installs to target the tarball. Separately, codemod second-pass idempotence and real GraphQL transport remain unproven by the inspected specific tests.